In recent years, systems are often constructed on the basis of a Web three-layer model (three-tier model). This three-tier model consists of a Web, an application and a DB (Data Base). On the basis of operations in which the Web calls the application and the application accesses the DB, a series of processes (business or a transaction) is performed.
In a three-tier system which executes processes regarding one transaction in a distributed manner, it has been difficult to know which process in each transaction takes the most time, unless each executed software is modified and altered. However, for example, in the banking business, in a large-scale system which realizes business such as a transfer process or referring to an account, from a Web server, a combination of software developed by various people or companies is often used to constitute the system. Thus, the software cannot be realistically altered. Hence, when performance of one transaction has degraded, a part of a specific cause has not been able to be known.
Consequently, as shown in FIG. 19, in a system composed of a plurality of computers, a system operation status analysis has been proposed in which data flowing on a network is observed and a processing time for each service providing function is calculated, without modifying the service providing function executed on each computer.
Japanese Laid-Open Patent Publication No. 2006-11683 (US Patent Application Publication No. 2005-0289231) discloses a system analysis apparatus which, on the basis of data obtained through observation on a network, generates transaction models from a set of messages on a system and call relationships among the messages, and analyzes an operation status of the system.
However, when the data on the network is observed, the data observation may partially fail. In such a case, all data related to the data for which the observation has failed cannot be used for an analysis process. In other words, when only a part of a message is unknown, the message cannot be restored even if other parts thereof are known, and moreover, the entire transaction is also handled as an incomplete transaction. Furthermore, it can be said that this is equal to a state where all messages regarding a corresponding transaction are not observed.
Moreover, there is a known technique in which, with respect to a message for which the data observation has partially failed, a content of a packet is estimated at a time point when the message is restructured. However, if an estimated value is not appropriate, the entire transaction is handled as an inappropriate transaction in this technique.
Consequently, in order to solve the above described problems, it is an object of the disclosed technique to enable estimation of the transaction which has not been able to be estimated before, and furthermore, in comparison with the case where packet loss data is directly estimated, to improve a success rate of a comparison process (hereinafter, referred to as “matching process”) with transaction models.